Machine Learning-Enabled Behavioural Analytics for Cyber Threat Detection in SCADA-Based Operational Technology Environments | JPES
JPES Journal Logo Platform
Back to Archive
Research Article Portal Node

Machine Learning-Enabled Behavioural Analytics for Cyber Threat Detection in SCADA-Based Operational Technology Environments

Author(s) Registry A. Chandra Sekaran
Volume RegistryVol 1
Issue ContextIssue 02
Published Timestamp12 Oct 2026
Digital DOI Handle*

Abstract

The integration of digital technologies in SCADA systems has made it easier to monitor and automate the industrial process, but at the same time, it has made the OT environment vulnerable to cyberattacks. The OT environment based on SCADA systems has unique operational requirements, has heterogeneous devices, continuous flow of data, and also has safety considerations. As a result, it becomes hard to detect any threats to the environment in a timely manner. Conventional approaches of intrusion detection rely heavily on predefined rules, signatures, and static behavioral models that might not be enough to identify unknown attacks and behavioral changes in devices and networks. In this research paper, an approach for detecting cyber threats using behavioral analytics through machine learning in SCADA-based OT environments has been suggested using a combination of Liquid Neural Networks (LNNs), Hypergraph Neural Networks (HGNNs), and Deep Evidential Learning (EDL). The LNN is employed to capture the temporal changes in the behavior of the system through its operations and data flows. The HGNN component is used to capture complex dependencies between devices, communication activities, network activities, and other interconnected entities in the OT environment, where conventional pairwise representation may fail to model dependencies between several entities. Proposed framework examines behavioral patterns in SCADA-related datasets and uses temporal patterns, high order dependencies, and evidential information to separate normal operational behavior from any potentially malicious behavior. Evaluation of the proposed framework provided 97.29% accuracy in identifying cyber threat patterns in the investigated SCADA-based OT environment

Keywords

SCADAOperational TechnologyCyber Threat DetectionMachine LearningBehavioral AnalyticsLiquid Neural NetworkHypergraph Neural NetworkDeep Evidential Learning.

References (16)

  1. Al-Qirim, Nabeel, et al. "Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks." International Journal of Engineering Business Management 17 (2025): 18479790251328183.
  2. Uzzaman, Arfan, and M. A. Rony. "Machine Learning–Based Cybersecurity Models for Safeguarding Industrial Automation And Critical Infrastructure Systems." International Journal of Scientific Interdisciplinary Research 4.4 (2023): 224-264.
  3. Kabir, S. Rayhan, et al. "SCADA Digital Twin and Cryptographic AMI Cyber-Twin for Smart Grid Security." Applied Sciences 16.15 (2026): 7655.
  4. Hasan, Mohammad Kamrul, et al. "Randomization based shallow and federated-deep learning for smart grid security using label-encoded vulnerabilities and distributed LSTM computation." PeerJ Computer Science 12 (2026): e3354.
  5. Lu, Kang-Di, et al. "Multi-objective discrete extremal optimization of variable-length blocks-based CNN by joint NAS and HPO for intrusion detection in IIoT." IEEE Transactions on Dependable and Secure Computing 22.4 (2025): 4266-4283.
Scholarly Citation Asset

Machine Learning-Enabled Behavioural Analytics for Cyber Threat Detection in SCADA-Based Operational Technology Environments

A. Chandra Sekaran, "Machine Learning-Enabled Behavioural Analytics for Cyber Threat Detection in SCADA-Based Operational Technology Environments," Journal of Progressive Engineering Studies (JPES), vol. 1, no. 2, pp. 71-78, 2026.